Senior Application Security Engineer

Malwarebytes is looking for a Senior Application Security Engineer with substantial experience securing Windows applications to join our security-first company. As a dedicated AppSec engineer in the AppSec team, you will use modern tools to identify, triage, and resolve security issues in close partnership with development teams. You will manage the bug bounty program and focus primarily on Windows application security, while also contributing to macOS, iOS, and Android security as needed. If you thrive on learning new technologies and working independently, we want to hear from you.

• Automate security processes and tooling within the CI/CD pipeline, including integrating SAST, DAST, and SCA tools to prevent classes of security issues.
• Perform and manage collaboration with external firms on security-focused code reviews and penetration tests. Triage the results and consult teams on severity and resolution.
• Support and consult with product and development teams on application security, including conducting threat modeling and design reviews.
• Administer and support the ongoing bug bounty program and security tools to ensure timely remediation of vulnerabilities. Assist the triage team and maintain effective collaboration with external researchers and the platform vendor.
• Work closely with development teams to validate reported vulnerabilities and verify that implemented fixes adequately mitigate the associated risks.
• Lead efforts to promote security best practices and foster a secure development culture across the organization.

• Proficiency managing a bug bounty program and hands-on experience with SAST, DAST, and SCA tooling.
• Ability to use GitHub and manage relevant GitHub Actions and GitHub Advanced Security features.
• Experience in code review & security analysis of desktop applications. Advanced knowledge of securing Windows desktop applications.
• Software development skills in C, C++, C#, or Java, and experience securing cloud services, desktop, and mobile applications.
• Excellent written and verbal communication skills with the ability to articulate complex security topics clearly and concisely to technical and non-technical audiences.
• Able to adapt quickly in a growing organization and solve problems collaboratively across development teams. Willing to learn new security technologies as business needs evolve.
• Able to work independently in high-risk environments with minimal supervision, being a self-starter.

Nice to have

• Red teaming experience
• Certifications in any of the following: CISSP, CEH, or GIAC Reverse Engineering.
• Hands-on experience in AWS and managing infrastructure with Terraform.
• Advanced knowledge of macOS, iOS, and Android security.
• Thorough knowledge of digital forensics methodology.
• Strong background in security architecture, system administration, and networking.

• Comprehensive medical, dental, and vision insurance coverage
• Employee Referral Bonus Program
• Wellness programs
• Comprehensive Time Off policy
• An opportunity to do something great for yourself and the world!